Privacy Policy

Last updated: September 30, 2026

This policy explains how Hoot & Lune (“we”, “us”) handles personal information when you visit hootandlune.com, create an account, contact us or buy from us. By using the site you agree to this policy and to our Terms of Service.

What we collect

• Contact details: your name, email address and, if you give it, phone number.
• Delivery details: your shipping address, and any addresses you save to your account.
• Orders: what you bought, prices paid, discount codes used, and delivery and tracking information.
• Account details: your password (stored only in scrambled, hashed form), and, if you sign in with Google or Apple, the account ID, name and email that provider shares with us.
• Messages: what you send through the contact form or by email, and the IP address it was sent from.
• Technical data: IP address, browser and device type, and the pages you visit, collected automatically when you use the site.

What we never see

Your card details. Payment happens on Stripe's secure page; card numbers go from your browser straight to Stripe and never pass through or get stored on our site. We receive only a payment reference, the card brand and its last four digits.

Why we use it

• To take payment, print and ship your order, and send receipts, shipping updates and tracking.
• To run your account, keep it secure and let you see your orders and saved addresses.
• To answer your messages and handle returns, refunds and complaints.
• To prevent fraud, abuse and security problems, and to keep the site working (error and performance monitoring).
• To understand which pages are visited, so we can improve the shop.
• To meet legal, tax and accounting obligations, and to protect our legal rights.

If you are in the UK or European Economic Area, our legal bases are: performing our contract with you (orders and accounts), our legitimate interests (security, fraud prevention, improving the shop), your consent (where we ask for it), and legal obligations (tax records).

Who we share it with

We share only what each service needs to do its job:

• Stripe: payment processing and fraud checks.
• Printify and its print partners: your name, address, phone (if given) and order details, so the item can be printed and posted.
• Shipping carriers: your name and address, passed on by the print partner, to deliver the parcel.
• Email delivery provider: your email address and the content of the emails we send you.
• Google and Apple: only if you choose to sign in with them.
• Google Analytics: page visits, device, browser and approximate location. We do not send it your name, email or orders.
• Hosting and monitoring providers: the servers that run the site, and the error and performance monitoring that keeps it working.

We may also share information when the law requires it, to protect our rights or the safety of others, or with a buyer if the business is ever sold. We do not sell your personal information, we do not share it for cross-context behavioural advertising, and there are no advertising trackers on this site.

Cookies

• Essential cookies: keep you signed in, protect forms against forgery, and remember your bag. The site does not work without them.
• Analytics cookies: Google Analytics, used to count visits. You can block them in your browser settings or with Google's opt-out add-on, and the shop still works.

How long we keep it

• Account details: until you delete your account or ask us to.
• Order records: as long as tax and accounting law requires (usually up to 7 years), then deleted or anonymised.
• Contact messages: as long as needed to deal with them, and then for up to 2 years in case the matter comes up again.
• Server and security logs: a short period, usually no more than a few months.

How we protect it

The site runs over HTTPS, passwords are hashed, payment is handled entirely by Stripe, and access to customer data is limited to people who need it to run the shop. No system is perfectly secure, so we cannot promise that information will never be accessed without permission, but if a breach affects you we will tell you as the law requires.

Your rights

Depending on where you live (for example California and other US states with privacy laws, or the UK and EEA), you may have the right to:

• know what personal information we hold about you and get a copy of it;
• have it corrected or deleted;
• object to or restrict how we use it, or withdraw consent;
• receive it in a portable format;
• opt out of the sale or sharing of your information (we do neither);
• not be treated differently for using these rights.

To use any of them, send a request through our contact form. We will confirm your identity before acting and reply within the time the law allows (usually 30 to 45 days). You can also update your details and addresses yourself in your account. If you are in the UK or EEA and are unhappy with our answer, you may complain to your local data protection authority.

Deleting your account removes your profile, saved addresses and sign-in methods. Order records we must keep for tax law are kept with the personal details removed where possible.

Emails we send

We send emails about your orders and your account, such as receipts, shipping updates and password resets. These are needed to provide the service. We do not send marketing emails unless you have agreed to them, and every marketing email has an unsubscribe link.

Do Not Track and Global Privacy Control

Because we do not sell or share personal information for advertising, there is nothing for these signals to switch off. We treat a Global Privacy Control signal as an opt-out request anyway.

Children

The site is not meant for children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, tell us through the contact form and we will delete it.

International visitors

We are based in the United States, and your information is processed and stored in the United States and wherever our service providers operate. Where the law requires it, those transfers are covered by appropriate safeguards.

Changes to this policy

We may update this policy and will change the date at the top when we do. If a change is significant, we will tell account holders by email or with a notice on the site.

Contact

Questions or requests about your data: use our contact form.